Create a webhook endpoint

import {
  isKnownEventType,
  verifyWebhookSignature,
  WebhookVerificationError,
  type UnknownWebhookEvent,
  type WebhookEvent,
} from "@billkit-eu/sdk";

const secret = process.env.BILLKIT_WEBHOOK_SECRET;
if (!secret) throw new Error("BILLKIT_WEBHOOK_SECRET is not set");

// Express here; any framework works as long as it hands you the raw body.
app.post("/webhooks/billkit", express.raw({ type: "application/json" }), async (req, res) => {
  const header = req.headers["billkit-signature"];
  let event: WebhookEvent | UnknownWebhookEvent;
  try {
    event = await verifyWebhookSignature({
      payload: req.body,
      signatureHeader: typeof header === "string" ? header : undefined,
      secret,
    });
  } catch (err) {
    if (err instanceof WebhookVerificationError) {
      res.status(400).send("invalid signature");
      return;
    }
    throw err;
  }

  // A type this SDK version does not know yet: acknowledge it and move on.
  if (isKnownEventType(event) && event.type === "invoice.payment_failed") {
    await dunning.start(event.data.customer_id);
  }
  res.json({ received: true });
});

import os

from billkit import WebhookSignature, WebhookVerificationError

@app.post("/webhooks/billkit")
def billkit_webhook():
    try:
        event = WebhookSignature.verify(
            payload=request.data,
            signature_header=request.headers.get("BillKit-Signature"),
            secret=os.environ["BILLKIT_WEBHOOK_SECRET"],
        )
    except WebhookVerificationError:
        return "invalid signature", 400

    if event["type"] == "invoice.payment_failed":
        dunning.start(event["data"]["customer_id"])

    return {"received": True}

<?php

use BillKit\Webhooks;
use BillKit\Exception\WebhookVerificationException;

$secret = getenv('BILLKIT_WEBHOOK_SECRET');
if ($secret === false || $secret === '') {
    throw new \RuntimeException('BILLKIT_WEBHOOK_SECRET is not set');
}

try {
    $event = Webhooks::verifySignature(
        payload: file_get_contents('php://input'),
        signatureHeader: $_SERVER['HTTP_BILLKIT_SIGNATURE'] ?? null,
        secret: $secret,
    );
} catch (WebhookVerificationException $e) {
    http_response_code(400);
    exit('invalid signature');
}

if ($event['type'] === 'invoice.payment_failed') {
    Dunning::start($event['data']['customer_id']);
}

<?php

namespace App\Listeners;

use BillKit\Laravel\Events\WebhookReceived;

// The package registers POST /billkit/webhook and verifies the
// signature before dispatching this event.
class HandleBillKitWebhook
{
    public function handle(WebhookReceived $event): void
    {
        if ($event->payload['type'] === 'invoice.payment_failed') {
            Dunning::start($event->payload['data']['customer_id']);
        }
    }
}

// Webhooks are server to server, and the signing secret must never
// reach a browser. Handle the event on your backend and let the page
// read the state your own API exposes afterwards.